CVEs published August 31, 2021
69 CVEs were published on August 31, 2021: 2 critical, 20 high.
- Published
- 69
- Critical
- 2
- High
- 20
- Medium
- 7
- Low
- 3
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- 8
- SolarWinds Orion Platform
- 8
- npm node-tar · tar
- 3
- matrix-org synapse · matrix-synapse
- 2
- npm arborist · @npmcli/arborist
- 2
- UniFi Protect application
- 2
- AT&T
- 1
- axios/axios · axios
- 1
- https://github.com/brave/brave-core
- 1
- IBM OpenPages with Watson
- 1
Critical 2
High 20
- CVE-2021-39176Missing Release of Memory after Effective Lifetime in detect-character-encodingsonicdoe detect-character-encoding · detect-character-encod…
- CVE-2021-39180Path Traversal in Archive Handling Leading to Code ExecutionOpenOLAT
- CVE-2021-39135UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm arborist · @npmcli/arborist
- CVE-2021-35212Blind SQL injection VulnerabilitySolarWinds Orion Platform
- CVE-2021-21811A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7.AT&T
- CVE-2021-39134UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm arborist · @npmcli/arborist
- CVE-2021-37713Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationnpm node-tar · tar
- CVE-2021-29907IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system.IBM OpenPages with Watson
- CVE-2021-35223Execute Command Function Allows Remote Code Execution (RCE)VulnerabilitySolarWinds Serv-U
- CVE-2021-35213Orion User setting Improper Access Control Privilege Escalation VulnerabilitySolarWinds Orion Platform
- CVE-2021-35239Stored XSS in Maps text box hyperlink VulnerabilitySolarWinds Orion Platform
- CVE-2021-35222Resource.aspx Reflected Cross-Site Scripting VulnerabilitySolarWinds Orion Platform
- CVE-2021-39316ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2021-35220EmailWebPage Command Injection RCESolarWinds Orion Platform
- CVE-2021-3749Inefficient Regular Expression Complexity in axios/axiosaxios/axios · axios
- CVE-2021-34581WAGO: Denial of Service vulnerability inside the OpenSSL implementationWAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889
- CVE-2021-34561A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebindingPhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-33555A vulnerability may allow remote attackers to read arbitrary files on the server of the WirelessHART-GatewayPhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-37701Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksnpm node-tar · tar
- CVE-2021-37712Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksnpm node-tar · tar
Medium, low and unrated 47
- CVE-2020-20495bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.
- CVE-2020-20490A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).
- CVE-2020-20486IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.
- CVE-2021-22003VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443.VMware Workspace ONE Access and Identity Manager
- CVE-2021-22002VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443VMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2021-22029VMware Workspace ONE UEM REST API contains a denial of service vulnerability.VMware Workspace ONE UEM console
- CVE-2021-36233The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary
- CVE-2021-36234Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
- CVE-2021-36231Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operat
- CVE-2021-36232Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges.
- CVE-2021-40085An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.neutron
- CVE-2021-37794A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a m
- CVE-2021-27668HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication.
- CVE-2021-22929An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps ohttps://github.com/brave/brave-core
- CVE-2021-22943A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network UniFi Protect application
- CVE-2021-22944A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to UniFi Protect application
- CVE-2021-22684Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc.Tizen RT RTOS
- CVE-2021-39164Improper authorisation of /members discloses room membership to non-membersmatrix-org synapse · matrix-synapse
- CVE-2021-39163Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.matrix-org synapse · matrix-synapse
- CVE-2021-35240Stored XSS via Help Server settingsSolarWinds Orion Platform
- CVE-2021-21681Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where theJenkins project Jenkins Nomad Plugin · org.jenkins-ci.plugi…
- CVE-2021-21680Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Nested View Plugin · org.jenkins-ci…
- CVE-2021-21679Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URLJenkins project Jenkins Azure AD Plugin · org.jenkins-ci.pl…
- CVE-2021-21678Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.Jenkins project Jenkins SAML Plugin · org.jenkins-ci.plugin…
- CVE-2021-21677Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializesJenkins project Jenkins Code Coverage API Plugin · io.jenki…
- CVE-2020-19049Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found
- CVE-2020-19048Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the
- CVE-2020-19047Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the compon
- CVE-2020-19046Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.
- CVE-2021-35221ImportAlert Improper Access Control Tampering VulnerabilitySolarWinds Orion Platform
- CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure VulnerabilitySolarWinds Orion Platform
- CVE-2021-34564In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookiePhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-34563In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify itPhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-34562A vulnerability in WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's responsePhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-34560A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive informationPhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-34559A vulnerability in WirelessHART-Gateway <= 3.0.8 may allow remote attackers to rewrite links and URLs in cached pages to arbitrary stringsPhoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH · Phoenix Contact…
- CVE-2021-38144An issue was discovered in Form Tools through 3.0.20.
- CVE-2021-38143An issue was discovered in Form Tools through 3.0.20.
- CVE-2021-38145An issue was discovered in Form Tools through 3.0.20.
- CVE-2020-13639A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications.
- CVE-2021-36356KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts a
- CVE-2021-27558A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such
- CVE-2021-27557A cross-site request forgery (CSRF) vulnerability in the Cron job tab in EasyCorp ZenTao 12.5.3 allows attackers to update the fields of a C
- CVE-2021-27556The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type par
- CVE-2021-3634A flaw has been found in libssh in versions prior to 0.9.6.libssh
- CVE-2021-36981In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to execute arbitrary cod
- CVE-2021-40330git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cr